p17860254
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Agent: Add tags to MSSQL propagation events

This commit is contained in:
Kekoa Kaaikala 2022-10-05 13:29:03 +00:00 committed by Ilija Lazoroski
parent aab965bad7
commit 8317c03686
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
monkey/infection_monkey/exploit/mssqlexec.py
View File

@ -8,6 +8,9 @@ import pymssql
from common.common_consts.timeouts import LONG_REQUEST_TIMEOUT from common.common_consts.timeouts import LONG_REQUEST_TIMEOUT
from common.credentials import get_plaintext from common.credentials import get_plaintext
from common.tags import ( from common.tags import (
T1059_ATTACK_TECHNIQUE_TAG,
T1071_ATTACK_TECHNIQUE_TAG,
T1105_ATTACK_TECHNIQUE_TAG,
T1110_ATTACK_TECHNIQUE_TAG, T1110_ATTACK_TECHNIQUE_TAG,
T1210_ATTACK_TECHNIQUE_TAG, T1210_ATTACK_TECHNIQUE_TAG,
) )
@ -26,6 +29,12 @@ logger = logging.getLogger(__name__)
MSSQL_EXPLOITER_TAG = "mssql-exploiter" MSSQL_EXPLOITER_TAG = "mssql-exploiter"
EXPLOITER_TAGS = (MSSQL_EXPLOITER_TAG, T1110_ATTACK_TECHNIQUE_TAG, T1210_ATTACK_TECHNIQUE_TAG) EXPLOITER_TAGS = (MSSQL_EXPLOITER_TAG, T1110_ATTACK_TECHNIQUE_TAG, T1210_ATTACK_TECHNIQUE_TAG)
PROPAGATION_TAGS = (
MSSQL_EXPLOITER_TAG,
T1059_ATTACK_TECHNIQUE_TAG,
T1071_ATTACK_TECHNIQUE_TAG,
T1105_ATTACK_TECHNIQUE_TAG,
)
class MSSQLExploiter(HostExploiter): class MSSQLExploiter(HostExploiter):
@ -83,12 +92,14 @@ class MSSQLExploiter(HostExploiter):
) )
logger.error(error_message) logger.error(error_message)
self._publish_propagation_event(self.host.ip_addr, False, error_message=error_message) self._publish_propagation_event(
self.host.ip_addr, False, PROPAGATION_TAGS, error_message
)
self.exploit_result.error_message = error_message self.exploit_result.error_message = error_message
return self.exploit_result return self.exploit_result
self._publish_propagation_event(self.host.ip_addr, True) self._publish_propagation_event(self.host.ip_addr, True, PROPAGATION_TAGS)
self.exploit_result.propagation_success = True self.exploit_result.propagation_success = True
return self.exploit_result return self.exploit_result